Red Hat Security: Linux in Physical, Virtual, and Cloud
This course is now legacy content
This course is using an outdated version of the technology and is now considered to be Legacy content. It will be removed from our catalog on June 28, 2024. Please be sure to complete your course and finish any remaining labs before that date. We recommend moving to version 9.2, which is the latest version currently available.
In this exercise, you will configure users as SELinux confined users to limit the mechanisms they may use to access the system and the superuser account.
Outcomes
You should be able to:
Prevent Linux users from switching to a different SELinux confined user.
Control the methods administrators are permitted to use to switch user with SELinux confined users.
Examine the effects of confined SELinux users on sudo, su, ssh, and SUID execution and explore relevant Booleans.
Confirm that the workstation and serverc machines are started.
Log in to workstation as student using student as the password.
On workstation, run lab selinux-users setup to verify that the environment is ready.
This script also creates the runme test program in /tmp and /home/student.
[student@workstation ~]$lab selinux-users setup
On
serverc, confine all Linux users exceptrootby mapping them to theuser_uSELinux user at login.Log in to
servercasstudent. No password is required.[student@workstation ~]$ssh student@serverc[student@serverc ~]$Display the SELinux user associated with
student.[student@serverc ~]$id -Zunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023Use the sudo -i command to switch identity to the
rootuser. Usestudentas the password.[student@serverc ~]$sudo -i[sudo] password for student:student[root@serverc ~]#Confirm that SELinux is in
enforcingmode.[root@serverc ~]#getenforceEnforcingRetrieve the mapping between the Linux and the SELinux users.
[root@serverc ~]#semanage login -lLogin Name SELinux User MLS/MCS Range Service__default__ unconfined_us0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 *Notice that by default, SELinux maps the Linux users to
unconfined_u. Also, changing this mapping has no impact on therootuser because it has its own rule.Change the default mapping to map the Linux users to
user_u. The semanage command may take up to a minute to complete.[root@serverc ~]#semanage login -m -s user_u -r s0 __default__[root@serverc ~]#Use the semanage login -l command again to verify your work.
[root@serverc ~]#semanage login -lLogin Name SELinux User MLS/MCS Range Service__default__ user_us0 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 *Log out of
serverc, then log in again asstudent.[root@serverc ~]#logout[student@serverc ~]$logout[student@workstation ~]$ssh student@serverc[student@serverc ~]$Use the id -Z command to confirm that SELinux maps
studenttouser_u.[student@serverc ~]$id -Zuser_u:user_r:user_t:s0Confirm that
studentcannot use the sudo or su commands anymore. For su, useredhatas the password for therootuser.[student@serverc ~]$sudo -isudo: PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted sudo: no valid sudoers sources found, quitting sudo: setresuid() [0, 0, 0] -> [1000, -1, -1]: Operation not permitted sudo: unable to initialize policy plugin[student@serverc ~]$su -Password:redhatsu: Authentication failure
Set the
user_exec_contentSELinux Boolean tooffto prevent users mapped touser_ufrom executing programs in/tmpor in their home directories.Verify that for now,
studentcan still execute programs in the/tmpdirectory onserverc.[student@serverc ~]$/tmp/runmeTested[student@serverc ~]$./runmeTestedThe runme program was deployed by the exercise setup script.
Because you can no longer use sudo -i to switch from
studenttoroot, log out fromservercand log in again asroot.[student@serverc ~]$logout[student@workstation ~]$ssh root@serverc[root@serverc ~]#Set the SELinux
user_exec_contentBoolean tooff. The setsebool command may take up to a minute to complete.[root@serverc ~]#setsebool -P user_exec_content off[root@serverc ~]#Log out of
servercand log in again asstudent. No password is required.[root@serverc ~]#logout[student@workstation ~]$ssh student@serverc[student@serverc ~]$Confirm that
studentcan no longer execute programs in/tmpor their home directory.[student@serverc ~]$/tmp/runme-bash: /tmp/runme: Permission denied[student@serverc ~]$./runme-bash: ./runme: Permission denied
Create the
operator1Linux user account as follows:The user is a system administrator and must be able to use the sudo and su commands. Map the user to the
sysadm_uSELinux user.Add the user to the
wheelgroup, to benefit from the existing sudo rule granting permission to run any command as any user.Set the user's password to
redhat.The
operator1user must be able to log in using ssh. Thesysadm_uSELinux user does not allow this by default, but you can meet this requirement by allowing users mapped tosysadm_uto use ssh to log in.
Log out of
servercand log in again asroot.[student@serverc ~]$logout[student@workstation ~]$ssh root@serverc[root@serverc ~]#Create the
operator1Linux user account, map it to thesysadm_uSELinux user, and add it to thewheelgroup. The useradd command may take up to a minute to complete.[root@serverc ~]#useradd -G wheel -Z sysadm_u operator1[root@serverc ~]#Confirm that SELinux maps
operator1tosysadm_u.[root@serverc ~]#semanage login -lLogin Name SELinux User MLS/MCS Range Service __default__ user_u s0 *operator1 sysadm_us0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 *Set the password for
operator1toredhat.[root@serverc ~]#echo redhat | passwd --stdin operator1Changing password for user operator1.Log out of
servercand try to use SSH to log in asoperator1user.[root@serverc ~]#logout[student@workstation ~]$ssh operator1@servercUnable to get valid context for operator1 Last login:Mon Jul 23 07:58:37 2018from workstation.lab.example.com Connection to serverc closed.[student@workstation ~]$By default, SELinux denies access to
sysadm_uaccounts over SSH.Log in as
rootand set thessh_sysadm_loginBoolean toon.[student@workstation ~]$ssh root@serverc[root@serverc ~]#setsebool -P ssh_sysadm_login on[root@serverc ~]#Log out of
servercand log in asoperator1. This time the connection succeeds.[root@serverc ~]#logout[student@workstation ~]$ssh operator1@serverc[operator1@serverc ~]$To confirm that
operator1can administer the system, use the sudo -i command to switch identity to therootuser and restart thehttpdservice. Useredhatas the password.[operator1@serverc ~]$sudo -i[sudo] password for operator1:redhat[root@serverc ~]#systemctl restart httpd[root@serverc ~]#systemctl is-active httpdactive
Create the
developer1Linux user account for your web developer.developer1is not a system administrator, but they need to be able to restart thehttpdservice with sudo.Create the user account as follows:
Map the
developer1user to thestaff_uSELinux user. Remember that if you do not explicitly map the user account, it is mapped touser_u, which does not allow sudo.Set the user's password to
redhat.Create a new sudo configuration file,
/etc/sudoers.d/developers, and add a rule to permitdeveloper1to run the systemctl restart httpd command asroot.
Create the
developer1Linux user account and map it to thestaff_uSELinux user. The useradd command may take up to a minute to complete.[root@serverc ~]#useradd -Z staff_u developer1[root@serverc ~]#Confirm that SELinux maps
developer1tostaff_u.[root@serverc ~]#semanage login -lLogin Name SELinux User MLS/MCS Range Service __default__ user_u s0 *developer1 staff_us0-s0:c0.c1023 * operator1 sysadm_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 *Set the password for
developer1toredhat.[root@serverc ~]#echo redhat | passwd --stdin developer1Changing password for user developer1.Create the
/etc/sudoers.d/developersfile and add a rule to permitdeveloper1to run systemctl restart httpd asroot.[root@serverc ~]#vim /etc/sudoers.d/developersdeveloper1 ALL=/bin/systemctl restart httpdLog out of
servercand log in asdeveloper1. No password is required.[root@serverc ~]#logout[operator1@serverc ~]$logout[student@workstation ~]$ssh developer1@serverc[developer1@serverc ~]$Use the id -Z command to confirm that SELinux maps
developer1tostaff_u.[developer1@serverc ~]$id -Zstaff_u:staff_r:staff_t:s0-s0:c0.c1023Notice that the current role is
staff_r.Only the
sysadm_rrole allows the execution of commands using sudo. Confirm that the current role,staff_r, does not allow the user to restart thehttpdservice using sudo. Useredhatas the password.[developer1@serverc ~]$sudo systemctl restart httpd[sudo] password for developer1:redhatFailed to get D-Bus connection: Operation not permittedTo run commands with sudo,
developer1needs to change its current role tosysadm_r. Log out ofservercand log in asroot. Use the semanage user -l command to confirm that SELinux allowsstaff_uusers to change role tosysadm_r.[developer1@serverc ~]$logout[student@workstation ~]$ssh root@serverc[root@serverc ~]#semanage user -lLabeling MLS/ MLS/ SELinux User Prefix MCS Level MCS Range SELinux Roles guest_u user s0 s0 guest_r root user s0 s0-s0:c0.c1023 staff_r sysadm_r system_r unconfined_rstaff_uuser s0 s0-s0:c0.c1023 staff_rsysadm_rsystem_r unconfined_r sysadm_u user s0 s0-s0:c0.c1023 sysadm_r system_u user s0 s0-s0:c0.c1023 system_r unconfined_r unconfined_u user s0 s0-s0:c0.c1023 system_r unconfined_r user_u user s0 s0 user_r xguest_u user s0 s0 xguest_rConfigure
sudoto perform the role change before running the command. Edit the/etc/sudoers.d/developersfile and insert theROLEvariable before the command.[root@serverc ~]#vim /etc/sudoers.d/developersdeveloper1 ALL=ROLE=sysadm_r/bin/systemctl restart httpdLog out of
servercand log in asdeveloper1.[root@serverc ~]#logout[student@workstation ~]$ssh developer1@serverc[developer1@serverc ~]$Confirm that
developer1can restarthttpd. Useredhatas the password. Log out when done.[developer1@serverc ~]$sudo /bin/systemctl restart httpd[sudo] password for developer1:redhat[developer1@serverc ~]$logout[student@workstation ~]$The systemctl restart command does not display anything when successful.
